Certainly there was no evidence; they likely have no logging anyway!
since they pasted customer creds in jira tickets they most likely are very liable hence the downplaying
im not an expert but if I was an investor I'd try to find a buyer for my shares and run
Also time to audit the auditors!
Re:PingCap TiDB Leaks
by alright2565 on Wednesday October 21, 2026 @11:18PM
(#50190756)
> in the systems reviewed
is load bearing I expect.
Also
> production systems
Wonder if they just reclassified all operational systems as pre-production, post-production, quasi-production etc.
Let's say you have a remote client connect to a url to the database. You stream a download through there. You close the connection when you're finished.
No commands run.
No persistent access.
Lawyers are amazing.
Edit: Yes, based on the comment by dherls, this is how they're getting around it. Streaming replication is not commands run by the attackers (it's your own system doing the exfiltration!)
" TiDB Cloud meet SOC 1 Type 2, SOC 2 Type 2, SOC 3, ISO 27001, ISO 27701, PCI DSS, GDPR, and HIPAA standards and requirements."
All those compliance meetings to gain all these badges; the results show
I find it really baffling how much they are downplaying this incident on their statement.
”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”
That does not appear to be true.